External risk intelligence

TrueBooker WordPress Plugin Account Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14545

The vulnerability exists in a WordPress plugin's front-end account handler. Because WordPress sites are frequently deployed as public-facing websites and the account reset functionality is accessed via the public web interface, it is commonly exposed to the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the TrueBooker WordPress plugin. It allows attackers to take over any website by resetting passwords without authentication, potentially gaining full administrative control. The main concern is confirming if this plugin is in use and if the affected functionality is exposed.

Unauthenticated attackers can reset any user's password.
Critical vulnerability can lead to complete website takeover.
Confirm TrueBooker plugin use and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain control of a WordPress site by exploiting a flaw in the TrueBooker plugin's password reset feature. This feature, accessible through the website's public interface, doesn't properly check if the person requesting a password reset actually owns the account. By triggering this, an unauthenticated attacker can reset the password for any account, including an administrator's, thus taking over the entire site.

No authentication required to access.
Attacker resets any user's password.
Complete site takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to reset the password for any user account, including administrator accounts, on a WordPress site using the TrueBooker plugin. When this occurs, the attacker could gain full control of the website, potentially altering its content or functionality.

Site administration control.
Unauthenticated password reset.
Complete website takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the TrueBooker WordPress plugin likely impacts application owners and potentially the infrastructure or platform teams responsible for managing the WordPress environment. The initial practical move is to identify all TrueBooker plugin instances, determine their exposure and business criticality, and then coordinate with the accountable site owner to plan remediation.

Site owners should confirm plugin usage.
Verify public-facing, unauthenticated access.
Plan coordinated remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TrueBooker plugin used for?

TrueBooker is an extension for WordPress websites, designed to manage scheduling and booking tasks. It provides front-end interfaces that allow users to interact with the site's reservation system directly from their browsers, often handling user account details and credentials as part of that workflow.

What does CWE-269 mean for CVE-2026-14545?

CWE-269 refers to Improper Privilege Management. In the context of CVE-2026-14545, this means the software fails to properly verify the identity or permissions of a user attempting to reset a password. Because it lacks this gatekeeping, the system incorrectly trusts the request, granting an attacker the ability to perform administrative actions they are not authorized to handle.

How does an attacker trigger this vulnerability?

An attacker triggers the bug by sending a crafted request to the plugin's front-end password reset handler. Since the code does not validate account ownership, no prior authentication or legitimate credentials are required. Note that this flaw is specific to the automated password reset mechanism; requests that do not target this specific functionality will not trigger the vulnerability.

Why should I care if my site is internet-facing?

Halo Surface Signal notes that since this plugin's handler operates via the public web interface, it is highly likely to be accessible over the internet. If your WordPress site is exposed, an attacker does not need internal network access to reach the vulnerable code, meaning they can attempt to compromise administrative accounts remotely from anywhere.

What is the first step to secure my site?

Your first step is to perform an inventory of your WordPress environment to identify if the TrueBooker plugin is installed. If you find the plugin, check the version number. Since this vulnerability affects versions before 1.2.4, you should prepare to update the software immediately and restrict access to the site's administrative areas while you coordinate a patch.

References

wpscan.com/vulnerability/c97d9841-2bd7-438b-a719-7943d671c754/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.